CVE-2024-32046: Detailed error discloses full file path with dev mode off
Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32046?
CVE-2024-32046 has a medium severity rating as it allows attackers to potentially expose sensitive server information.
How do I fix CVE-2024-32046?
To fix CVE-2024-32046, upgrade to Mattermost version 9.6.1, 9.5.3, 9.4.5, or 8.1.12.
What versions of Mattermost are affected by CVE-2024-32046?
Mattermost versions 9.6.0 and below, 9.5.2 and below, 9.4.4 and below, and 8.1.11 and below are affected by CVE-2024-32046.
What kind of information can be leaked by CVE-2024-32046?
CVE-2024-32046 can leak detailed error messages containing server information, such as file paths.
Is developer mode relevant in the context of CVE-2024-32046?
No, even with developer mode off, CVE-2024-32046 still reveals detailed error messages.